Fix SELinux backup execution context and probe source metadata before downtime

usr-local-sbin/app-backup.sh

@@ -24,7 +24,7 @@ init_runtime
 build_plan
 preflight
 if [[ $CHECK == true ]]; then
-  echo 'Preflight passed. No source copy, service stop, dump, upload or deletion performed.'
+  echo 'Preflight passed. Directory metadata probed; no application backup, service stop or upload performed.'
   exit 0
 fi
 STAGING_DIR=$(mktemp -d "$STAGING_ROOT/${RUN_ID}.XXXXXX")
@@ -58,7 +58,8 @@ for i in "${!LABELS[@]}"; do
   exclusions "$label"
   echo "-- Copy: $label ($src)"
   # Never accept vanished-file (24) or partial-copy (23) as success.
-  rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$src/" "$STAGING_DIR/$root/"
+  # Parent retains both locks; rsync itself needs neither inherited descriptor.
+  rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$src/" "$STAGING_DIR/$root/" 8>&- 9>&-
   printf '%s\t%s\n' "$label" "$src" >> "$PLAN"
 done
 # The full consistency window includes all dumps AND copies. Compression/upload

usr-local-sbin/app-restore.sh

@@ -53,7 +53,7 @@ else
   input_real=$(realpath -e "$LOCAL_RUN")
   stage_real=$(realpath -e "$STAGING_DIR")
   [[ $stage_real != "$input_real" && $stage_real != "$input_real/"* ]] || die 'Backup source contains restore workspace'
-  rsync -a -- "$LOCAL_RUN/" "$INPUT/"
+  rsync -a -- "$LOCAL_RUN/" "$INPUT/" 8>&- 9>&-
 fi
 if [[ $LEGACY == true ]]; then
   echo 'WARNING: Legacy backup has no trusted manifest/completeness proof.'
@@ -172,7 +172,7 @@ for i in "${!SELECTED[@]}"; do
   else
     exclusions "$label"
     if [[ $RESTORE_STRICT_DELETE == true ]]; then EXCLUDES+=(--delete-delay); fi
-    rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$source_path/" "${TARGETS[i]}/"
+    rsync -aHAX --numeric-ids "${EXCLUDES[@]}" -- "$source_path/" "${TARGETS[i]}/" 8>&- 9>&-
   fi
 done
 # A backup captured maintenance=true. Enforce the recorded pre-restore state even